by Kastro
Paper/Archive/CVE-2021-24229

CVE-2021-24229

Unknown Patreon WordPress — Patreon WordPress < 1.7.2 - Reflected XSS on patreon_save_attachment_patreon_level AJAX action

EPSS 2%CVSS 9.6
critical.is priorityof 100
44
CVSS 9.6 (NVD)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 78.0.780 × 2015.6No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The Jetpack Scan team identified a Reflected Cross-Site Scripting via the patreon_save_attachment_patreon_level AJAX action of the Patreon WordPress plugin before 1.7.2. This AJAX hook is used to update the pledge level required by Patreon subscribers to access a given attachment. This action is accessible for user accounts with the ‘manage_options’ privilege (i.e.., only administrators). Unfortunately, one of the parameters used in this AJAX endpoint is not sanitized before being printed back to the user, so the risk it represents is the same as the previous XSS vulnerability.

Affected

ProductAffectedFixed inSource
Patreon WordPress1.7.2 – < 1.7.21.7.2CNA

Scores by source

NVD9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

References

refjetpack.com/2021/03/26/vulnerabilities-found-in-patreon-wordpress-pluginrefwpscan.com/vulnerability/001755c4-add3-4566-a022-ab1f83546c1f